# How to Stop Email Spoofing of Your Domain

> Anyone can put your address in the From line unless you stop them. Learn how SPF, DKIM and DMARC block spoofing, and how to protect domains you never send from.

Published 2026-11-05. Source: https://mailions.com/blog/stop-email-spoofing

Email was designed without sender verification. By default, anyone can type any address into the From line of a message, and nothing in the original protocol stops them. That is email spoofing, and it is the foundation of most phishing and business email compromise attacks that pretend to come from a company's own domain.

You cannot stop someone from *trying*. You can make sure that receivers reject their attempts. Here is how.

## What spoofing looks like

- An "invoice" from `accounts@yourcompany.com` asking a customer to pay into a new bank account.
- A message that appears to come from your CEO asking an employee to buy gift cards.
- A password-reset phishing email using your brand name and domain.

In all of these the attacker controls their own server and puts your domain in the visible From field. Without protection, some receivers will accept them.

## Why SPF and DKIM alone are not enough

[SPF](/blog/what-is-spf-record) checks the hidden envelope sender. [DKIM](/blog/what-is-dkim) checks whichever domain signed the message. An attacker can pass both for a domain *they* own, while showing your domain to the reader. Neither one connects the check to the address a person sees.

**DMARC does.** It requires SPF or DKIM to pass *and* to align with the visible From domain, and it tells receivers what to do when that fails. Read the details in [what DMARC is](/blog/what-is-dmarc).

## The four-step defence

### 1. Authenticate everything you send

List every system that sends as your domain: your mail server, website, helpdesk, billing and marketing tools. Make sure each one passes SPF or DKIM with your domain. If a legitimate sender fails, a strict DMARC policy will block it.

### 2. Publish DMARC and read the reports

Start with `p=none` and an `rua` mailbox. The reports list every source sending as your domain, including attackers. See [how to read DMARC reports](/blog/read-dmarc-reports).

### 3. Move to enforcement

Step up to `p=quarantine`, then `p=reject`, gradually and with the reports as your guide ([safe rollout plan](/blog/dmarc-policy-rollout)). At `p=reject`, receivers that honour DMARC refuse unauthenticated mail using your exact domain.

### 4. Protect the domains you do not use

Attackers love forgotten domains, old brands and common typos. For any domain that sends no email, publish both records:

```
yourdomain.net.        TXT  "v=spf1 -all"
_dmarc.yourdomain.net. TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com"
```

This tells the world that no mail from that domain is legitimate. Do the same for subdomains you do not send from, using the `sp=reject` tag on the parent.

## What DMARC will not stop

Being honest about limits helps you plan the rest of your defence:

- **Look-alike domains.** `yourcornpany.com` with "rn" for "m", or `your-company-support.com`, pass authentication for *their* domain. Register obvious variants, and monitor new registrations if your brand is a target.
- **Display-name spoofing.** The attacker writes "Your CEO" as the display name from a free webmail address. Train staff to look at the actual address, and consider rules that flag external senders using internal names.
- **Compromised real accounts.** If someone steals a password and sends from the genuine mailbox, authentication passes. Use strong, unique passwords and two-factor sign-in wherever available.
- **Unprotected receivers.** A few smaller servers ignore DMARC.

## Extra layers worth adding

| Layer | What it does |
|---|---|
| Two-factor authentication on mailboxes and DNS accounts | Stops account takeover, and protects the DNS where your records live |
| Registry lock / strong registrar security | Prevents domain hijacking |
| BIMI (optional) | Shows your verified logo in some inboxes once DMARC is enforced |
| User training | Covers display-name and look-alike attacks |
| Reporting mailbox | A place staff forward suspicious messages |

## A short checklist

1. SPF, DKIM and DMARC published and passing for each real sender.
2. DMARC reports flowing to a monitored mailbox.
3. Policy at `quarantine` or `reject` on the main domain.
4. Non-sending domains locked with `-all` and `p=reject`.
5. Look-alike domains registered or monitored.
6. Two-factor on email and DNS accounts.

## Where Mailions helps

Mailions gives each domain its own DKIM key plus the SPF and DMARC records to publish, and checks them against live DNS, so the first three items are quick to complete. For mailboxes, two-factor sign-in is available for panel accounts, and passwords are hashed with bcrypt. Spoofing protection is a continuing job, not a one-off setup: use the reports to keep your sender list current.

## Frequently asked questions

### How do I stop someone spoofing my email domain?

Publish SPF listing your senders, sign mail with DKIM, and add a DMARC record that you raise to quarantine and then reject once reports show your legitimate mail passes. Receivers then refuse mail that falsely uses your domain.

### Why can people still send emails that look like they come from me?

DMARC protects only your exact domain in the From address. Lookalike domains, misleading display names and hacked accounts are not covered, so staff awareness and watching for lookalike registrations still matter.

### Does SPF alone prevent spoofing?

No. SPF checks the hidden envelope sender, not the From address people see, so an attacker can pass SPF with their own domain while showing yours. DMARC ties SPF and DKIM to the visible From address.